Privacy Policy

This policy explains how Amblemead Ltd (the data controller for Dugsy's Football Challenge) collects, uses and protects your personal data. We follow the UK GDPR and the Data Protection Act 2018.

1. Who we are

Amblemead Ltd, registered in England. Contact: admin@amblemead.co.uk.

2. Data we collect

• Account details — your email address, display name and a one-way hashed copy of your password (we never store the plain password).
• Predictions and scores — the numbers you submit for each match and the points calculated.
• Timestamps — when your account was created and when you submit each prediction.
• Authentication cookie — a single httpOnly cookie called dugsy_access_token that keeps you signed in.

We do not collect IP addresses, device IDs, marketing data, payment details, or any special-category data.

3. How we use your data

• To provide your account and the prediction features.
• To display your name and points on leaderboards visible to other signed-in players.
• To send password-reset emails when you request one, using the email provider Resend.
• To investigate misuse or breaches of our Terms of Service.

4. Lawful bases

We process your data under (a) performance of a contract (delivering the service you signed up for), and (b) our legitimate interest in running a usable, abuse-free product.

5. Who we share data with

• Resend (resend.com) — when we send you a password-reset email. Only your email address and a one-time reset link are shared.
• Emergent (emergent.sh) — hosting provider for the app and its MongoDB database.

We do not sell your data and we do not share it with marketers, advertisers, or analytics platforms.

6. International transfers

Resend operates from the United States. When we send you a password-reset email, your email address is transferred to the US under appropriate safeguards (standard contractual clauses or an equivalent UK transfer mechanism).

7. How long we keep your data

We keep your account and predictions for as long as you have an active account. If you ask us to delete your account, or the administrator deletes it, your personal data and predictions are permanently removed from our database within 30 days. Password reset tokens are one-time use and expire after one hour.

8. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data (the "right to be forgotten");
• restrict or object to certain processing;
• receive a copy of your data in a portable format;
• complain to the UK Information Commissioner's Office (ico.org.uk) if you think we have mishandled your data.

To exercise any of these, email admin@amblemead.co.uk and we'll respond within one month.

9. Cookies

Dugsy's Football Challenge uses one strictly-necessary authentication cookie. Full details are on our dedicated Cookie Policy page. We do not use analytics, advertising or third-party cookies.

10. Children

Dugsy's Football Challenge is intended for users aged 13 or over. If you are under 13, please do not register or send us your personal data. If we discover that a child under 13 has provided us with personal data without parental consent, we will delete that information promptly.

11. Security

Passwords are stored using bcrypt one-way hashing. Authentication uses a signed JWT delivered via an HttpOnly cookie. The service is served over HTTPS only. No security can be guaranteed perfect — please use a strong, unique password and report anything suspicious to admin@amblemead.co.uk.

12. Changes

We may update this policy occasionally. Material changes will be flagged on the login page or the next time you sign in.